USPTO Patents Application 09672206

f 0 MOSE R . PATTERSON

03/16/04 14:11 FAX 73^530 9?03 MOSE R PATTERSON SHERIDAN^ PTO ©013/021

Response under 37 C.F.R. 1.111
Serial No. 09/672,206
Page 8 of 16

Remarks

In view of the following discussion, the Applicant submits that none of the
claims now pending in the application are non-enabling, anticipated, or obvious
under the respective provisions of 35 U.S.C. § 1 12, §102, and §103. Thus, the
Applicant believes that all of these claims are now in allowable form. Applicant
also believes that any alleged deficiencies in the specification and/or drawings
have been satisfactorily corrected in this Response.

It is to be understood that the Applicant, does not acquiesce to the
Examiner's characterizations of the art of record or to Applicant's subject matter
recited In the pending claims. Further, Applicant is not acquiescing to the
Examinees statements as to the applicability of the prior art of record to the
pending claims by filing this Response. ,

Objections

A. IN THE DRAWINGS:

The Examiner has objected to the drawings as failing to comply with 37
C.F.R. §1 .84(p)(5) because they include the reference sign 31 1 in Fig. 3 without
being mentioned in the written specification.

In response, Applicant has hereinabove provided a replacement
paragraph at page 7, lines 2-6 of the originally filed specification. Specifically,
the replacement paragraph describes the method steps of the subject invention
at a point where it is appropriate to introduce step 311 . Accordingly, clarification
of where the process continues after step 309 is provided by identifying the
process as continuing to step 311 after step 309, No new matter has been
entered by virtue of this amendment as support is clearly found in Fig. 3.
Accordingly, withdrawal of the objection is respectfully requested.

PAGE 1 3/21 • RCVD AT 3116/2004 2:03:25 PNI [Eastern Standard Time] ' SVR:USPT0-EFXRF-1/5 1 DNIS:8729306 ' CSID:732 530 9808 * DURATION (mm-ss):04-58

3^^30 MOSER PATTERSON SHE^

03/16/04 14:11 FAX 73^530 9808 MOSER PATTERSON SHERIDAN* PTO ©014/021

Response under 37 C.F.R. 1.111
Serial No. 09/672,206
Page 9 of 16

B. IN THE SPECIFICATION:

The Examiner has indicated that the Abstract is objected to because of the

length of the abstract

In response, Applicant has amended the Abstract so that it Is in conformity
with 37 C.F.R. §1.72. Accordingly, withdrawal of the objection is respectfully
requested.

The Examiner has also objected to the written specification because of the
alleged inconsistency in the language at page 4, line 13.

In response, Applicant has hereinabove amended the paragraph in
accordance with the Examiner's recommendation (i.e., Intranet 140 has been
changed to Intranet 141). Accordingly. Applicant respectfully requests that the
objection be withdrawn.

Rejections

Rejection of Claims under 35 U.S.C. 5 112

The Examiner has rejected claims 1-4 and 8 under 35 U.S.C. § 112,
second paragraph as being indefinite for failing to particularly, point out and
distinctly claim the subject matter which Applicant regards as the invention.
Specifically, in each of the above-identified claims, there is an alleged insufficient
antecedent basis for different phrases in the claims.

In response, Applicant has hereinabove amended each of the above
identified claims to correct any alleged deficiencies with regard to antecedent
basis. The above-identified amendments are self exploratory in nature; thus, no
additional commentary is necessary. If the Examiner still finds any antecedent
basis problems with any of the amendment claims, Applicant requests Examiner
to contact Applicant's below signed agent to discuss same informally before
preparation of an additional Official Action.

PAGE 14/21 1 RCVD AT 3/16/2004 2:03:25 PM [Eastern Standard Time] * SVR:USPT0-EFXRF-1/5 * DNIS:8729306 ' CSID:732 530 9808 ' DURATION (mm-ss):04-58

'^^30 MOSER PATTERSON

03/16/04 14:11 FAX 732 o30 9 ¥08 MOSER PATTERSON SHERIDAN^ PTO (2)015/021

Response under 37 C.F.R. 1.111
Serial No. 09/672,206
Page 10 of 16

Rejections of claims under 35 U.S.C. S 102

Claims 1, 2 and 5-9 are rejected under 35 U.S. C. §102(e) as being
anticipated by U.S. Patent Number 6,609,205 issued August 19, 2003 to
Bernhard etaL (hereinafter 'Bernhard 1 '). Specifically, the Examiner alleges that
Bernhard discloses a method for thwarting coordinated SYN denial of service
attacks against a server In a network comprising the steps of controlling a
network switch to divert a predetermined fraction of SYN packets destined for a
server, to a web guard processor, establishing a first TCP connection between
one or more clients originating the packets and the web guard processor and a
second TCP connection between the clients and server. The Examiner offers
Fig. 1 and Col. 4, lines 12-27 for disclosing an intrusion detection system (sensor
1 1 ) capable of examining packets of TCP protocols. The Examiner further offers
that Bernhard allegedly teaches monitoring the number of timed-out connections
between the web guard server and the clients as per Col. 7, lines 28-37. The
Examiner also offers controlling of a switch to divert all SYN packet destined to a
server to the web guard processor. Specifially, once a SYN event occurs, the
process determines whether ACK occurs. If the number of SYN packets
exceeds 50, all SYN packets are released and misuse is detected per Fig. 2, Col.
3, lines 41-52; Col. 6, lines 46-51 and Col. 9, lines 5-18. The Examiner also uses
the above-identified portions of Bernhard to allege anticipation of elements of
claims 2, 5, 6, 7, 8, and 9. In response the rejection is respectfully traversed.

Applicant offers that while Bernhard is in the technical field of the subject
invention, there are deficiencies in the exact teachings of Bernhard. "Anticipation
requires the presence in a single prior art reference disclosure of each and every
element of the claimed Invention , arranged as in the claim" (Lindemann
Maschinenfabrik GmbH v. American Hoist & Derrick CoL 730 F.2d 1452, 221
USPQ 481 , 485 (Fed. Clr. 1 984) (citing Connell v. Sears. Roebuck & Co. , 722
F.2d 1542, 220 USPQ 193 (Fed. Cir. 1983)) (emphasis added). Bernhard fails to

PAGE 15/21 1 RCVD AT 3/16/20M 2:03:25 PM pastern Standard Time] * SVR:U$PT0£FXRM/5 * DNIS:8729306 4 CSID:732 530 9808 * DURATION (mm-ss):04'58

3^^30 ^T^8 MOSER PATTERSON SI^R^

03/16/04 14:11 FAX 73^530 9808 MOSER PATTERSON SHERIDAN^* PTO ©016/021

Response under 37 C.F.R. 1.111
Serial No. 09/672,206
Page 11 of 16

i

disclose each and every element of the claimed invention', as arranged in the

claim. ;

The Examiner has expanded upon the claim language to force the
teachings of the prior art to fit the claimed element, and thereby support the
conclusion of anticipation. Such action is not permissible!. The prior art must be
such that a person of ordinary skill in the field of the invention would consider
there to be no difference between the claimed invention and the reference
disclosure. Scripps Clinic & Research Foundati on v. Gerientech. Inc.. 927 F.2d
1565 18 USPQ 2d 1001, 1010 (Fed. Cir. 1991). In other words, the prior art

' j

reference must put the claimed invention in the hand of one skilled in the art. In
re Donohue , 766 F.2d 531, 533, 226 USPQ 619, 621 (Fe|d. Cir. 1985).

Specifically, a first point is that Bemhard does notjteach, disclose or
suggest a "predetermined fraction of SYN packets" being diverted or otherwise
processed in accordance with the subject invention. The Examiner cites Col. 4.
lines 12-27 to support his position on this specific element of the claimed
invention; however, that portion of Bernhard does not spfeak of examining a
predetermined fraction of SYN packets. Rather, it only provides for a general
examining of packets in the overall system. Each packet coming into the sensor
(1 1) Is examined (per Col. 4, lines 38-40), but the reference falls short in
additional specific teachings as to how many packets are sent along this path. It

is clearly not known by examining Bemhard how many packets are in fact tested

i

or how the selection of tested packets is determined, j

The Examiner then offers three specific portions of Bemhard to allege a

i

teaching of what happens to packets once the alarm event has occurred.
Specifically, the Examiner offers Col. 3. lines 41-52, Col| 6, lines 46-52 and Col.
9, lines 5-18. However, in each of the three above cited portions of Bernhard,
there is no specific teaching regarding diverting of all pajckets destined to a
server to a web guard processor. For example, Col. 3, jines 41-52 presents only
terminating a connection if intrusion is detected. That is, there is no specific
teaching or disclosure of diverting packets by virtue of tjiis terminated

PAGE 16/21 ' RCVD AT 3/16/2004 2:03:25 PM [Eastern Standard Time] ' SVR:USPT0-EFXRF-1/5 1 ON!S:8729306 1 CSID:732 530 9808 ' DURATION (mnvss):04-58

3^^30 1^8 MOSER PATTERSON S^RI

03/16/04 14:12 FAX 73ST530 9808 MOSER PATTERSON SHERIDAN + PTO ©017/021

Response under 37 C.F.R. 1.111
Serial No. 09/672,206
Page 12 of 16

connection. Further, and with respect to claim 7, there is also no specific
discussion of forwarding packets to a TCP oroxv in the manner claimed.

Further to these points, Col. 6, lines 46-51 presents the specifics of what
occurs in Bernhard when the count runs above 50 with a certain time period (an
alarm is Indicated), but the cited portion does not teach , disclose or suggest
anything with regards to diverting of packets (with respect to claims 1 and 8) or
establishing TCP proxies (with respect to claim 7) once the alarm condition is
realized. Finally, and with respect to Col. 9, lines 5-1 8, this cited portion
generally discusses another embodiment of Bernhard, but does not go into
specifics of diverting packets as indicated above (with respect to claims 1 and 8)
or establishing TCP proxies (with respect to claim 7).

As such, the Applicants submit that claims 1 , 7 and 8 are not anticipated
and fully satisfy the requirements under 35 U.S.C. § 102 and are patentable
thereunder. Furthermore, claims 2-6 and 9 depend, either directly or indirectly,
from independent claims 1 and 8 and recite additional features thereof. As such,
and for at least the same reasons discussed above, the Applicants submit that
these dependent claims also fully satisfy the requirements under 35 U.S.C. § 102
and are patentable thereunder. Therefore, the Applicants respectfully request
that the rejection be withdrawn.

Rejection of Claims unde r 35 U.S.C. S 103

Claims 3 and 4 are rejected under 35 U.S.C. § 103(a) as being obvious
and unpatentable over Bernhard in view of U.S. Published Application No. U.S.
2003/0110394 to Sharp et al. (hereinafter Sharp), published June 12. 2003.
Specifically, the Examiner indicates that Bernard allegedly discloses the claimed
invention as described above with respect to the specifics indicated in the 102
rejection section; however, Bernhard did not explicitly teach if the number of
timed-out connections between the web guard and the clients exceed a second
predetermined threshold to delete ail SYN packets destined for the server.

PAGE 17121 ' RCVD AT 3/1612004 2:03:25 PM [Eastern Standard Time] ' SVR:USPT0-EFXRM/5 » DNIS:8729306 ' CSID:732 530 9808 1 DURATION (mm*S):04-58

'^^30 MOSER PATTERSON SI^I

03/16/04 1 4:12 FAX 7 3^530 9808 MOSER PATTERSON SHERIDAN^* PTO Bl 018/021

Response under 37 C.F.R. 1.111
Serial No. 09/672,206
Page 13 of 16

However, Sharp allegedly discloses a method used to detect and prevent
spoofing where when it comes to flooding, there are four threshold levels that
exist. As such, it would have been obvious to one of ordinary skill in the art the
time the invention was made to combine the teachings of Sharp and the system
of Bernhard because as higher thresholds are violated, the system automatically
begins the process of chocking and holding certain packets while sending alarms
and notifications to different areas in the system. The rejection is respectfully
traversed.

The test under 35 U.S.C. § 103 is not whether an improvement or a use
set forth in a patent would have been obvious or non-obvious; rather the test is
whether the claimed invention, considered as a whole , would have been obvious,
Jones v. Hardy , 110 USPQ 1021, 1024 (Fed. Cir. 1984) (emphasis added).
Thus, it is impermissible to focus either on the "gist" or "core" of the invention,
Bausch & Lomb. Inc. v. Barnes-Hind/Hvdrocurve. Inc. , 230 USPQ 416, 420 (Fed.
Cir. 1986) (emphasis added). Moreover, the invention as a whole is not
restricted to the specific subject matter claimed, but also embraces its properties
and the problem it solves. In re Wright, 6 USPQ 2d 1959, 1961 (Fed. Cir. 1988)
(emphasis added).

It has been above argued and presented that Bernhard does not form the
basis for an adequate rejection under the anticipation statute. That is, Bernhard
is missing important elements regarding the predetermined diversion of a number
of packets as well as subsequently diverting all packets.. Therefore, Bernard in
combination with any other secondary cited art which allegedly introduces
additional features of the subject invention but still does not address the missing
elements in Bernhard does not result in the claimed invention. Specifically,
claims 3 and 4 depend either directly or indirectly from claim 1 which has been
discussed above. The addition of how Sharp allegedly handles alarm conditions
does not make the subject invention obvious in view of a method that does not
handle SYN packet movement in the manner claimed.

PAGE 1 8/21 * RCVD AT 3/1 612004 2:03:25 PM [Eastern Standard Time] * SVR:USPT0-EFXRM/5 * DNiS:8729306 * CSID:732 530 9808 1 DURATION (mm-ss):04-58

3^^30 MOSER PATTERSON SHE^

03/16/04 14:12 FAX 732 530 9808 MOSER PATTERSON SHERIDAN * PTO @ 019/021

Response under 37 C.F.R. 1.111
Serial No. 09/672,206
Page 14 of 16

Additionally, it is respectfully submitted that Sharp may in fact not be
applicable prior art. It is respectfully indicated that Applicants filing date of the
subject application is September 28, 2000. The filing date of Sharp is indicated
as February 20, 2002. As such, Sharp was filed subsequent to the filing date of
Applicant's invention. It is also noted that Sharp is a continuation-in-part of an
application filed on June 6, 2001 (which is also subsequent to the filing date of
Applicant's subject application). Also noted is that the June 6, 2001 application is
a continuation-in-part of an application filed on May 17, 2000. Therefore, if the
material that the Examiner is relying on to establish the teachings or suggestions
of Sharp are contained only in the February 20, 2002 or June 6, 2001 filings, then
Sharp is not applicable prior art under the rejection. As such, it is respectfully
submitted that the rejection under 35 U.S.C. § 103 may be improper. At the very
least, said rejection is imperfect in that the effective filing date of the material
relied upon by the Examiner is at this time undetermined and the prima facie
case of obviousness at question. "Unless the filing date of the earlier non-
provisional application is actually needed, for example in the case of an
interference or to overcome a reference, there is no need for the office to make a
determination as to whether the requirement of 35 U.S.C. § 120, that the earlier
non-provisional application discloses the invention of the second application in
the manner provided by the first paragraph of 35 U.S.C, § 1 12, is met and
whether a substantial portion of all of the earlier non-provisional application is
repeated in the second application in a continuation-in-part situation." MPEP §
201 .08. Since the filing date of the earlier non-provisional is needed, the Office
must make the appropriate determination; as to the disclosure of material therein.
It is respectfully submitted that the appropriate reference should be cited and
subsequently provided to the Applicant (per MPEP 707.05(a)) to perfect or
appropriately substantiate the 1 03 rejection.

As such, Applicants submit that claims 3 and 4 are not obvious and fully
satisfy the requirements under 35 U.S.C. § 103 and are patentable thereunder.
Therefore, the Applicants respectfully request that the rejection be withdrawn.

PAGE 19/21 ' RCVD AT 3(1612004 2:03:25 PM [Eastern Standard Time]' SVR:USPT0-EFXRF-1/5 * DNIS:8729306 ' CSID:732 530 9808 1 DURATION (mm-ss):04-58

• • #

3~30 9808 MOSER PATTERSON SHERI

03/16/04 14:13 FAX 732^30 9808 MOSER PATTERS ON SHERIDAN + PTO ©020/021

Response under 37 C.F.R. 1.111
Serial No. 09/672.206
Page 15 of 16

CONCLUSION

Thus, the Applicants submit that claims 1-9 are ^condition for allowance.
Furthermore, the specification and Abstract has been anjended as requested by
the Examiner. Accordingly, both reconsideration of this application and its swift
passage to issue are earnestly solicited. •

Applicants undersigned Agent thanks Examiner l^hosravan and

i!

Supervisory Patent Examiner Dharia for their preliminary teleconferences
regarding the subject application. It is respectfully requested that upon review of
this Response, and before preparation of a second OfffcSe Action, the Applicant
be granted a telephone interview In accordance with thei| interview request faxed
to Examiner Khosravan on March 10, 2004. Applicant is awar© of the time
constraints place on the Examiner and thanks the Examiner in advance for
providing the Applicant with the opportunity to discuss tine merits of the case to
facilitate disposition of the application.

Resp^ctfully^dbmitted ,

»agnotta, Agent
'Reg. No. 39,322
(732) 530-9404

Moser, Patterson & Sheridan, LLP
595 Shrewsbury Avenue
Suite 100

Shrewsbury, New Jersey 07702

PAGE 20/21 ' RCVDAT 3/16/2004 2:03:25 PM [Eastern Standard Time]* SVR:USPT0-EFXRF-1/5* DM8:8729306* CSID:732530 9808 ' DURATION (mm-ss):04-58

03/16/04 14:13 FAX 732 530 9806

MOSER PATTER SON S HER ID AN PT0

@021/02l

Response under 37 C.F.R. 1.111
Serial No. 09/672,206
Page 16 of 16

CERTIFICATE OF FACSIMILE TRANSMISSION under 137 C.F.R. 55 1.6 and 1.8

I certify that this correspondence is being
37 C.F.R. §§ 1 .6 and 1 .8 on J/JAArS* a
Commissioner for Patents, Washington, D.C. 20231,

transmitted by facsimile under
tnd is addressed to the
Facsimile Number: #~?±-?Z*C*

Type or print name of person signing certification
Signature

PAGE 21/21 1 RCVD AT 3(1612004 2:03:25 PM [Eastern Standard Time] * SVR:USPT0-EFXRF-1/5 * DNIS:8729306 * CSiD:732 530 9808 1 DURATION (mm-ss):04-58